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Enclosed please find the our correspondence with attached Abod & Caruso data breach form letter. 
This email is being forwarded on behalf of David J. Shannon. Please direct all inquiries to Mr. 
Shannon at 215.575.2615 
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This e-mail transmission and any documents, files or previous e-mail messages attached to it, are confidential and are protected by the attorney-client privilege and/or work 
product doctrine. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any review, disclosure, 
copying, dissemination, distribution or use of any of the information contained in, or attached to this e-mail transmission is STRICTLY PROHIBITED. If you have received 
this transmission in error, please immediately notify me by forwarding this e-mail to DALeconte@MDWCG.com , or by telephone at (212) 376-6456 and then delete the 
message and its attachments from your computer. 
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May 25, 2018 


Via Email: ag.breach@ct.gov 

Attorney General George Jepsen 
Office of Attorney General 
Attn: Security Breach Notification 
55 Elm Street 
Hartford, CT 06106 

RE: Abod & Caruso, LLC 

Our File No . 04MMQ125 


Dear Attorney General Jepsen: 

Pursuant to Conn. Gen. § 36a-701b, we are writing to notify you of a data security incident involving 1 
Connecticut resident. We are submitting this notification on behalf of our client, Abod & Caruso, LLC. 

Nature Of The Security Breach 

Abod & Caruso is a law firm based in Gaithersburg, Maryland. On April 2, 2018, Abod & Caruso 
became aware that a hard drive containing information on closed client files was accessed without authorization 
on that date. As a result, some of the personal information belonging to a Connecticut resident may have been 
exposed to others, including the first and last name, home address, social security number and/or alien 
registration number. 

The resident involved in this incident was forwarded a letter notifying the resident of this incident on 
May 17, 2018. A copy of the form letter is attached hereto. 

Steps Taken Relating To The Incident 

Upon discovering the incident, Abod & Caruso immediately had the device that was accessed taken off¬ 
line so that the files contained on the device could no longer be accessed. Abod & Caruso's forensic 
information technology personnel analyzed the compromised device and conducted an internal root-cause 
analysis to determine how this incident occurred and who was impacted. The analysis to date has revealed that 
unauthorized access occurred but Abod & Caruso has found no evidence that any personal information was in 
fact compromised or taken. 
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To prevent a similar incident from happening in the future, Abod & Caruso engaged an independent 
computer forensic firm to ensure that its internal systems are secure. Abod & Caruso is also in the process of 
reviewing its internal policies and data management protocols and has implemented enhanced security 
measures. All employees will be retrained on cybersecurity and privacy best practices. 

Abod & Caruso has also arranged to have Experian monitor the affected individuals' credit for one yeai 
at no cost to them through its IdentityWorks SM credit monitoring services. 

Should you need additional information regarding this matter, please contact me. 


Very truly yours, 



DAVID J. SHANNON 


DJS:jl 

Enel. 



Abod & Caruso, LLC 


Attorneys and Counselors at Raw 
18524 Office Park Drive 
Gaitlversbutg, MD 20882 
Telephone: (202)462-9701 
Facsimile: (202)609-9921 


DATE 

NAME 

STREET ADDRESS 
CT1Y, STATE and ZIP 


Dear [NAME], 

Our firm represents individuals in various legal matters. The privacy and protection of our client's, and your 
information, is a matter that we take very seriously. We are writing to inform you of a data incident at Abod & 
Caruso, LLC that may involve some of your personal information. 


What Happened 1 

On April a, 2018 , a hard drive containing information on closed client files was accessed without authorization. 
The device that was accessed tvas immediately taken off-line however some files contained on the device could 
have been accessed during this brief period. Your personal information may have been in these files. 


What Information Was Involved 

Based on our investigation into this matter, we have determined that the personal information which may have 
been accessed includes first and last names, home addresses, social security numbers and/or alien registration 
numbers. 

What We Are Doing , 

Immediately after the incident was discovered, we conducted an internal root-cause analysis to determine how 
this incident occurred and who was impacted. Our analysis to date has determined that an unauthorized access 
occurred but we have found no evidence that any personal information was in fact compromised or taken. 

To prevent a similar incident from happening in the future, we have engaged an independent computer forensic 
firm to ensure that our internal systems are secure. Our forensic information technology personnel analyzed the 
compromised device and immediately removed it from our computer system. We are also in the process of 
reviewing internal policies and data management protocols and have implemented enhanced security measures. 
All employees will be retrained on cybersecurity and privacy best practices. 

What we are doing to protect your Information! 

To help protect your Identity, we are offering a complimentary one-year membership of Experian’s® 
ldentltyWorks SM . This product provides you with superior identity detection and resolution of identity theft. To 
activate your membership and start monitoring your personal information please follow the steps below: 

• Ensure that you enroll by: August 31,2018 (Your code will not work after this date.) 

• Visit the Experian identftyWorks website to enroll: tvww.exp6rianidworks.com/3bci-edit 

• Provide your activation code: lg||6l|J 

If you have questions about the product, need assistance with identity restoration or would like an alternative to 
enrolling In Experian tdentityWorks online, please contact Experian's customer care team at 877.890.9332 by 
August 31, 2018, Be prepared to provide engagement number # BB06833 as proof of eligibility for the identity 
restoration services by Experian. 


ADDITIONAL DETAILS REGARDING YOUR 12-MONTH EXPERIAN IDENTiTYWORKS MEMBERSHIP: 



A credit card is not required for enrollment in Experian IdentityWorks. 

You can contact Experian immediately regarding any fraud issues, and have access to the following features 
once you enrol! in Experian IdentityWorks: 

- Experian credit report at signup: See what information is associated with your credit file. Daily credit 

reports are available for online members only.* 

■ Credit Monitoring: Actively monitors Experian file for indicators of fraud, 

» Identity Restoration: Identity Restoration agents are immediately available to help you address credit 
and non-credit related fraud. 

» Experian IdentityWorks ExtendCARE™: You receive the same high-level of Identity Restoration support 
even afteryour Experian IdentityWorks membership has expired, 

» Up to $1 Million Identity Theft insurance**: Provides coverage for certain costs and unauthorized 
electronic fund transfers. 


If you believe there was fraudulent use of your information and would like to discuss how you may be able to 
resoive those issues, please reach out to an Experian agent at 877 . 890 , 9332 . If, after discussing your situation 
with an agent, it is determined that Identity Restoration support is needed, then an Experian Identity 
Restoration agent is available to work with you to investigate and resoive each incident of fraud that occurred 
(including, as appropriate, helping you with contacting credit grantors to dispute charges and close accounts; 
assisting you in placing a freeze on your credit file with the three major credit bureaus; and assisting you with 
contacting government agencies to help restore your identity to its proper condition). 

Please note that this Identity Restoration support is available to you for one year from the date of this letter and 
does not require any action on your part at this time. The Terms and Conditions for this offer are located at 
www, ExoerianlDWorks.com/restoratlon . You will also find self-help tips and information about identity 
protection at this site. 

We sincerely apologize for this incident and regret any Inconvenience It may cause you. Should you have 
questions or concerns regarding this matter, please do not hesitate to contact us at (202) 462-9701. 


Sincere!' 



Curtis P. Abod 
Member 

Abod & Caruso, LEG 


* Offline members wilt be eligible to call for additional reports quarterly after enrolling 

** identity theft insurance Is underwritten by Insurance company subsidiaries or affiliates of American International Group, Inc. (AlG), 
The description herein is a summary and intended for informational purposes only and does not include all terms, conditions and 
exclusions of the policies described. Please referto the actual policies for terms, conditions, and exclusions of coverage. Coverage may 
not be available in all jurisdictions 


information about Identity Theft Prevention 


We recommend that you regularly review statements from your accounts and periodically obtain your credit report 
from one or more of the national credit reporting companies. You may obtain, a free copy of your credit report online at 
mw.annualcreditreport.eom, by calling toll-free or by mailing an Annual Credit Report Request 

Form (available atwvw.annualcreditreport.com) to: Annual Credit Report Request Service, P . 0 . Box 105281, Atlanta, 
GA, 30348-5281. You may also purchase a copy of your credit report by contacting one or more of the three national 
credit reporting agencies listed below, 



Equifax: P.O. Box 740241, Atlanta, Georgia 30374-0241,1-800-685-1111, wvw.equifax.com 

Experlan: P.O. Box 9532, Allen, TX 75013,1-888-397-3742, wvw.experian.com 

TransUnion: P.O. Box 1000, Chester, PA 19022,1-800-888-4213, wviv.transunion.com 

When yon receive your credit reports, review them carefully. look for accounts or creditor inquiries that you did not 
initiate or do not recognize. Look for infonnation, such as home address and Social Security number, that is not 
accurate. Ifyou see anything you do not understand, call the credit reporting agency at the telephone number on the 
report 

We recommend you remain vigilant with respect to reviewing your account statements and credit reports, and 
promptly report any suspicious activity or suspected identity theft to the proper law enforcement authorities, including 
local law enforcement, your state's attorney general and/or the Federal Trade Commission (“FfC’'), You may contact 
the FTC or your state's regulatory authority to obtain additional information about avoiding identity theft. 

Federal Trad e Commission, Consumer Response Center,6oo Pennsylvania Avenue, NW, Washington, DC 
20580, l-877-IDTHEFT (438-4338), www.ftc.gov/idtheft 

For residents of Maryland; You may also obtain information about preventing and avoiding identity theft from 
the Maryl and Office of the Attorney General: Maryland Office of the Attorney General, Consumer Protection 
Division 200 St. Paul Place, Baltimore, MD 21202,1-888-743-0 0231 vvtvw.oag.Btate.md.its 

For residents of North Carolina: You may also obtain information aboutpreventing and avoiding identity 
theft from the North Carolina Attorney General’s Office: North Carolina Attorney General’s Office, 
Consumer Protection Division, 9001 Mail Service Center, Raleigh, NC 27699-9001,1-877-5-NO-SCAM, 
vsnm.ncdoi.gov 

You may want to order copies of your credit reports and check for any bills tliatyou do not recognize, If you find 
anything suspicious, call the credit reporting agency at the phone number on the report. Keep a copy of tins notice for 
your records in case of future problems with your records. Ifyou are a California resident, we suggest that you visit the 
web site of the California Office of Privacy Protection at www.privacy.ca.gov to find more information about your 
privacy. 

Fraud Alerts: There are also two types of fraud alerts that you can place on your credit report to put your creditors on 
notice that you may be a victim of fraud: an initial alert and an extended alert. You. may ask that an initial fraud alert be 
placed on your credit report ifyou suspectyou have been, or are about to be, a victim of identity theft An initial fraud 
alert stays on your credit report for at least 90 days. You may have an extended alert placed on your credit report if you 
have already been a victim of identity' theft with the appropriate documentary proof. An extended fraud alert stays on 
your credit report for 7 years. You can place a fraud alert on your credit report by calling the toll-free fraud number of 
any of the three national credit reporting agencies listed below. 

Equifax: 1-888-766-0008, ivwtv.eqtiifax.com 

Experlan: 1-888-397-3742, wvw.experian.com 

TransUnion: 1-800-680-7289, fraud.transunion.com 

Credit Freezes: You may have the right to puta credit freeze, also knotvn as & security freeze, oayour credit file, so 
that no new credit can he opened in your name without the use of a PIN number that is issued to you when you initiate 
a freeze. A credit freeze is designed to prevent potential credit grantors from accessing your credit report without your 
consent. Ifyou place a credit freeze, potential creditor's and other thirdparties will not be able to get access to your 
credit reportunless you temporarily lift the freeze. Therefore, using a credit fr eeze may delay your ability to obtain 
credit In addition, you may incur fees to plaee, lift and/or remove a credit freeze. Credit freeze laws vary from state to 
state. The cost of placing, temporarily lifting, and removing a credit: freeze also varies by state, generally $5 to $20 pei^ 
action at each credit reporting company. Unlike ajfraud alert, you must separately piece a credit freeze on your credit 
file at each credit reporting company, Since the instructions for how to establish a credit freeze differ fr om state to 
state, please contact the three major credit reporting companies as specified below to find out more information: 

Equifax: P.O. Box 105788, Atlanta, GA 30348, wwv.equifrtx.com 

Experian: P.O. Box. 9554, Allen, TX 75013, www.experian.com 

TransUnion LLC; P.O. Box 2000, Chester, PA, 19022-2000, freeze.franstmion.com 


You can obtain more information about fraud alerts and credit freezes by contacting the FTC or one of the national 
credit reporting agencies listed above. 



